N. Korean Hackers Use ChatGPT to Launch Deepfake ID Phishing Attack: Report

A suspected North Korean state-backed hacking group used ChatGPT to create fabricated military identification cards (IDs) in a phishing campaign targeting South Korean military agencies and civil society groups.

Seoul-based cybersecurity firm Genians said the group, known as Kimsuky, sent emails containing malware while pretending to ask recipients to review “sample” ID card designs for civilian employees, The Korea Herald reported.

The attached images were deepfakes, or AI-generated to look like real IDs, making the phishing attempts seem legitimate, along with messages containing links that installed malware capable of stealing information from victims’ computers and devices.

The hackers appear to have bypassed ChatGPT’s restrictions on creating government IDs by presenting their requests as harmless mock-up designs.

“They probably persuaded the AI models by saying they were producing sample designs, not replicating actual military ID cards,” the outlet quoted Genians as saying.

Researchers also found the phishing emails were sent from fake web addresses such as “.mli.kr,” designed to look like South Korea’s official defense websites ending in “.mil.kr.”

Expanding Role of AI in Cyber Attacks

The incident highlights Pyongyang’s increasing use of generative AI and deepfake technologies in cyber operations.

In August, US-based AI firm Anthropic revealed that North Korean hackers had used its Claude model to create fake résumés, cover letters, and coding samples to get jobs at overseas IT companies. 

Once employed, the hackers allegedly used AI to perform technical work and gather intelligence.

“While AI services offer convenience in the workplace, they also carry the risk of being exploited for cyber operations with potential national security consequences,” Anthropic warned.

Mun Chong-hyun, director at Genians, said hackers can now use generative AI for nearly every stage of an attack, “from planning and developing malware to impersonating recruiters.”

Longstanding Espionage Network

Kimsuky has long been identified by Washington and Seoul as Pyongyang’s state-sponsored cyber-espionage group, with the US Department of Homeland Security describing the unit as “most likely tasked by the North Korean regime with a global intelligence-gathering mission.”

Officials say North Korea’s broader cyber strategy includes phishing, cryptocurrency theft, and secret IT contracting to raise money for its heavily sanctioned nuclear weapons program.

The number of victims in the latest phishing campaign is not yet known, according to The Korea Herald.